Security Advisory

CVE-2026-85660

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-04 14:32:18

Last updated 2026-09-04 17:50:30

Assigner VulnCheck

CVSS score 9.2

State PUBLISHED

Description

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled. Attackers can use shell command substitution syntax like $(...) or backticks to execute non-allowlisted commands that bypass the ALLOWED_COMMANDS validation check.

← Browse all CVEs View on cve.org ↗